Potentially useful configs

[XAMPPRocky]

Not sure where to put this, so a discussion seems like the best place, but the log4shell vulnerability, and seeing that someone had created a regex to catch log4shell payloads, had me wondering if Quilkin could help catch this for UDP based services, and with #458 and #447 it turned out to be pretty straightforward (I also need a Drop filter, but that's simple). Once this is supported, I wonder if there is some way we can showcase potentially generally useful configurations like this one.

# Catches and drops payloads containing potential log4shell payloads.
version: v1alpha1
proxy:
  port: 7001
static:
  endpoints:
  - address: 127.0.0.1:4321
  filters:
  - name: quilkin.extensions.filters.capture.v1alpha1.Capture
    config:
      metadataKey: log4shell
      strategy:
        kind: regex
        regex: "(?im)(?:^|[\n]).*?(?:[\x24]|%(?:25%?)*24|\\u?0*(?:44|24))(?:[\x7b]|%(?:25%?)*7b|\\u?0*(?:7b|173))[^\n]*?((?:j|%(?:25%?)*(?:4a|6a)|\\u?0*(?:112|6a|4a|152))[^\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))[^\n]*?((?:l|%(?:25%?)*(?:4c|6c)|\\u?0*(?:154|114|6c|4c))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?:[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52|162))[^\n]*?(?:m|%(?:25%?)*(?:4d|6d)|\\u?0*(?:4d|155|115|6d))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))|(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))){2}[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f|157|117))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))|(?:c|%(?:25%?)*(?:43|63)|\\u?0*(?:143|103|63|43))[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f|157|117))[^\n]*?(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52|162))[^\n]*?(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:h|%(?:25%?)*(?:48|68)|\\u?0*(?:110|68|48|150))(?:[^\n]*?(?:t|%(?:25%?)*(?:54|74)|\\u?0*(?:124|74|54|164))){2}[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?:[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163)))?)[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))[^\n]*?(?:e|%(?:25%?)*(?:45|65)|\\u?0*(?:45|145|105|65))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))(JH[s-v]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]))"
  - name: quilkin.extensions.filters.matches.v1alpha1.Matches
    config:
        metadataKey: log4shell/is_present
        fallthrough: pass
        branches:
        - value: true
          filter: quilkin.extensions.filters.drop.v1alpha1.Drop

[markmandel]

Couple of ideas:

• I would suggest adding a "Configurations" section under "Examples" in https://googleforgames.github.io/quilkin/main/book/
• Add a folder in https://github.com/googleforgames/quilkin/tree/main/examples to have a series of examples.

I think for individual examples, it would be better in the book, since it's likely more searchable.

Sounds like it would be super useful!

[Prefix]

CS:GO reverse-proxy server on quilkin (on-premise)
It allows players to connect from proxy ip, but they also have proxy client ip.
Could be used to connect to the server from proxy behind firewalls or host server and hide real server ip
Eitherway both real server ip and client ip is quite hidden unless game server would give in real server ip with command "status" eg on csgo?

Download current release as it is here https://github.com/googleforgames/quilkin/releases/tag/v0.2.0
Grab executable make chmod +x quilkin
Move it to /usr/bin/ to reach command as quilkin
Make config folder /etc/quilkin
Create 2 configs
/etc/quilkin/quilkin_27005.yaml

proxy:
  id: my-proxy-27005 # An identifier for the proxy instance.
  port: 27005 # the port to receive traffic to locally
static: # Provide static configuration of endpoints
  endpoints: # array of potential endpoints to send on traffic to
    - address: xx.xx.xx.xxx:27005

/etc/quilkin/quilkin_27015.yaml

admin:
  address: 0.0.0.0:9092 # because of 2 instances
proxy:
  id: my-proxy-27015 # An identifier for the proxy instance.
  port: 27015 # the port to receive traffic to locally
static: # Provide static configuration of endpoints
  endpoints: # array of potential endpoints to send on traffic to
    - address: xx.xxx.xxx.xx:27015```
    
Launch like this: 
quilkin run --config /etc/quilkin/quilkin_27005.yaml & 
quilkin run --config /etc/quilkin/quilkin_27015.yaml &